A finance clerk gets an email from a supplier they have paid for years. The account number has changed. The tone is ordinary. The payment goes out before anyone rings the supplier on the number from last month's invoice. Somewhere else, a different person is watching a pension balance climb on a screen that will not let them withdraw without one more fee. Interpol's 2026 Africa sweep was built out of cases like those two, not out of one gang with one name.
Operation Serengeti III was a two-month police action. Between 29 June and 31 August 2026, investigators in 21 countries went after cyber-enabled fraud, ransomware, business email compromise, online scams and digital extortion. Interpol announced the results on 22 October 2026: 1,462 suspects arrested, 10,909 malicious networks disrupted, and more than $105 million recovered. The arrest tally is the headline. The shape of the fraud is what a reader can actually recognise.
How it works
- A supplier, an executive or a lawyer appears to change bank details, or to ask for a transfer that should not be discussed. The message is a lookalike domain, or a genuinely hijacked account. Hijacked is worse, because the address is real.
- The payment goes before anyone rings the person who supposedly sent the instruction. The quiet and the hurry are the same instruction.
- In the other version, an investment or pension pitch arrives through an ad or a chat app. The screen goes up. A withdrawal needs one more fee. The fee leaves. The balance stays.
- Under both versions sits a login. A phishing page or mail collects the password that lets someone send the quiet payment, or open the platform, in the victim's name.
Business email compromise is the dull name for the changed account number. The romance-then-investment version, the one with the balance that only rises, is described in Pig butchering: romance, then a crypto account. The raids treated them as one operation because the networks selling them overlapped, not because a changed invoice and a fake pension are the same phone call.
Signs and red flags
A payment instruction that arrives with secrecy, a new account, and no time to check it on a known phone number. An investment chat that will not let you withdraw without a further fee. A login page that is one letter off a bank, a fund, or a payroll system. Messages that move you off company email and onto a private app before any money is discussed. The move to a private app is so the company's own mail filter never sees the next message.
Cases and figures
Interpol said the operation identified 65,929 victims, and that financial investigators linked the activity to losses above $385 million. The recovered sum, more than $105 million, is what police say they got back, not what victims lost. The gap between those two figures is the part a headline flattens. Several investigations were still open when the figures were published. Arrest figures are not convictions.
Kaspersky, which shared threat data with the operation, described two of the fraud cases. In Uganda, police broke up two cross-border rings and arrested 365 foreign nationals tied to investment and pension fraud aimed at people in Asia. The typing was in one place. The people losing the pension money were in another. In Nigeria, one phishing and business-email case had gathered about 2.1 million email addresses. An address list of that size is a queue. It is not 2.1 million losses. It is the raw material for the quiet payment and the fake login.
What to do and where to report
If a transfer has just gone to a new account, call your bank on a number you already have, not the one in the message. If the pitch was an investment or a pension and you are in the United States, file at ic3.gov. In the United Kingdom, use Action Fraud and the notes on Get help for the UK. Elsewhere, report to the police and the financial regulator where you live. Do not pay a "recovery agent" who found you after the raid was in the news. A raid does not file your transfer for you.
Start at Get help. The follow-on pitch is covered on Fake recovery.
This is general information, not legal or financial advice. The rules and the figures change. If money has already left, contact the bank and the authorities through the help pages.